{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/shield-fast-practical-defense-and-vaccination","title":"Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression","arxiv_id":"1802.06816","date":"2018-02-19","proceeding":null,"authors":["Nilaksh Das","Madhuri Shanbhogue","Shang-Tse Chen","Fred Hohman","Siwei Li","Li Chen","Michael E. Kounavis","Duen Horng Chau"],"abstract":"The rapidly growing body of research in adversarial machine learning has\ndemonstrated that deep neural networks (DNNs) are highly vulnerable to\nadversarially generated images. This underscores the urgent need for practical\ndefense that can be readily deployed to combat attacks in real-time. Observing\nthat many attack strategies aim to perturb image pixels in ways that are\nvisually imperceptible, we place JPEG compression at the core of our proposed\nShield defense framework, utilizing its capability to effectively \"compress\naway\" such pixel manipulation. To immunize a DNN model from artifacts\nintroduced by compression, Shield \"vaccinates\" a model by re-training it with\ncompressed images, where different compression levels are applied to generate\nmultiple vaccinated models that are ultimately used together in an ensemble\ndefense. On top of that, Shield adds an additional layer of protection by\nemploying randomization at test time that compresses different regions of an\nimage using random compression levels, making it harder for an adversary to\nestimate the transformation performed. This novel combination of vaccination,\nensembling, and randomization makes Shield a fortified multi-pronged\nprotection. We conducted extensive, large-scale experiments using the ImageNet\ndataset, and show that our approaches eliminate up to 94% of black-box attacks\nand 98% of gray-box attacks delivered by the recent, strongest attacks, such as\nCarlini-Wagner's L2 and DeepFool. Our approaches are fast and work without\nrequiring knowledge about the model.","url_abs":"http://arxiv.org/abs/1802.06816v1","url_pdf":"http://arxiv.org/pdf/1802.06816v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"shield-fast-practical-defense-and-vaccination","repo_url":"https://github.com/poloclub/jpeg-defense","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"shield-fast-practical-defense-and-vaccination","repo_url":"https://github.com/Yuxin33/unmask","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"shield-fast-practical-defense-and-vaccination","repo_url":"https://github.com/rickyHong/JPEG-Defense-repl","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1802.06816","atlas_url":"https://app.syntology.ai/?focus=1802.06816","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1802.06816"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Yuxin33/unmask","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/rickyHong/JPEG-Defense-repl","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/poloclub/jpeg-defense","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":8},"by_repo_kind":{"official":{"samples":8,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"6ef0c2eb320c0a86","entry":"convert_to_tf_records","repo":"poloclub/jpeg-defense","repo_kind":"official","path":"setup/get_imagenet.py","file_url":"https://github.com/poloclub/jpeg-defense/blob/HEAD/setup/get_imagenet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6ef0c2eb320c0a86"}},{"code_sha256_prefix":"d00593d15ba54117","entry":"decode_tf_example","repo":"poloclub/jpeg-defense","repo_kind":"official","path":"shield/utils/io.py","file_url":"https://github.com/poloclub/jpeg-defense/blob/HEAD/shield/utils/io.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d00593d15ba54117"}},{"code_sha256_prefix":"25314c2b6b249806","entry":"denoise_tv_bregman","repo":"poloclub/jpeg-defense","repo_kind":"official","path":"shield/utils/defenses.py","file_url":"https://github.com/poloclub/jpeg-defense/blob/HEAD/shield/utils/defenses.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"25314c2b6b249806"}},{"code_sha256_prefix":"ced1769c54400840","entry":"download_dataset","repo":"poloclub/jpeg-defense","repo_kind":"official","path":"setup/get_imagenet.py","file_url":"https://github.com/poloclub/jpeg-defense/blob/HEAD/setup/get_imagenet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ced1769c54400840"}},{"code_sha256_prefix":"84c15e8da6684464","entry":"encode_tf_example","repo":"poloclub/jpeg-defense","repo_kind":"official","path":"shield/utils/io.py","file_url":"https://github.com/poloclub/jpeg-defense/blob/HEAD/shield/utils/io.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"84c15e8da6684464"}},{"code_sha256_prefix":"461c651a7c596197","entry":"jpeg_compress","repo":"poloclub/jpeg-defense","repo_kind":"official","path":"shield/utils/defenses.py","file_url":"https://github.com/poloclub/jpeg-defense/blob/HEAD/shield/utils/defenses.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"461c651a7c596197"}},{"code_sha256_prefix":"2151d7e8bc19e996","entry":"load_image_data_from_tfrecords","repo":"poloclub/jpeg-defense","repo_kind":"official","path":"shield/utils/io.py","file_url":"https://github.com/poloclub/jpeg-defense/blob/HEAD/shield/utils/io.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2151d7e8bc19e996"}},{"code_sha256_prefix":"4f75328fa7d45fe6","entry":"median_filter","repo":"poloclub/jpeg-defense","repo_kind":"official","path":"shield/utils/defenses.py","file_url":"https://github.com/poloclub/jpeg-defense/blob/HEAD/shield/utils/defenses.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4f75328fa7d45fe6"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}